Deletion cascades to all related personal data records

GDPR Article 17(1) requires erasure of all personal data concerning the data subject — not just the primary contact row. CCPA §1798.105 similarly covers all personal information collected. Personal data in an email platform is routinely scattered across contacts, consent records, email event logs (with IP addresses and user agents), form submissions, and analytics events. Deleting the contacts row while leaving IP addresses and email addresses in event tables violates the right to erasure. CWE-459 (Incomplete Cleanup) and CWE-212 (Improper Removal of Sensitive Information) both apply: the deletion path exists but does not clean up the full surface area of PII.

Maintain an explicit PII_TABLES inventory in your deletion service so new tables cannot be added to the schema without also being added to the erasure path:

// src/lib/compliance/deletion.ts
const PII_TABLES = [
  { table: 'contacts',        column: 'id',         action: 'anonymize' },
  { table: 'consent_records', column: 'contact_id', action: 'anonymize-ip' },
  { table: 'email_events',    column: 'contact_id', action: 'anonymize' },
  { table: 'form_submissions',column: 'contact_id', action: 'delete' },
  { table: 'opt_out_requests',column: 'contact_id', action: 'retain-anonymized' },
] as const

In tests, assert that every table in PII_TABLES has zero readable PII after erasure. Cross-reference your database migration history for any table that references contact_id — each one must appear in this list.